AEAD 可购物性信封
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
- 受影响的版本
- 所有 Tink 版本
- 受影响的密钥类型
- 所有信封 AEAD 密钥类型
说明
信封加密使用第三方提供商（如 GCP 或 AWS）来加密数据加密密钥 (DEK)。
将 KmsEnvelopeAead 与 AwsKmsAead 或 GcpKmsAead 作为远程提供程序时，可以在不经检测的情况下修改已加密 DEK 的某些部分。这是由于其中包含未经身份验证的元数据（例如实例版本号）。提供程序不会检测到对这些未经身份验证的数据的修改。
请注意，虽然密文仍然可以解密为正确的 DEK，但这违反了此接口的自适应所选密文攻击属性 (IND-CCA-2)。使用此接口时，不要假设每个 DEK 仅对应于一个加密的 DEK。
如未另行说明，那么本页面中的内容已根据知识共享署名 4.0 许可获得了许可，并且代码示例已根据 Apache 2.0 许可获得了许可。有关详情，请参阅 Google 开发者网站政策。Java 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-07-25。
[null,null,["最后更新时间 (UTC)：2025-07-25。"],[[["\u003cp\u003eAll versions of Tink and all Envelope AEAD key types are affected by a security vulnerability.\u003c/p\u003e\n"],["\u003cp\u003eThe vulnerability allows modification of unauthenticated metadata within encrypted data encryption keys when using KmsEnvelopeAead with AwsKmsAead or GcpKmsAead.\u003c/p\u003e\n"],["\u003cp\u003eWhile the ciphertext can still be decrypted, this vulnerability violates the adaptive chosen-ciphertext attack property (IND-CCA-2).\u003c/p\u003e\n"],["\u003cp\u003eDevelopers should be aware that a single data encryption key might correspond to multiple encrypted data encryption keys due to this issue.\u003c/p\u003e\n"]]],["Envelope encryption, using `KmsEnvelopeAead` with `AwsKmsAead` or `GcpKmsAead`, allows undetectable modifications to the encrypted data encryption key (DEK) due to unauthenticated metadata. All Tink versions and Envelope AEAD key types are affected. While decryption still yields the correct DEK, this violates the adaptive chosen-ciphertext attack property (IND-CCA-2). Each DEK may correspond to multiple encrypted DEKs; users shouldn't assume a one-to-one mapping.\n"],null,["# Envelope AEAD Malleability\n\nAffected Versions\n: All Tink versions\n\nAffected Key Types\n: All Envelope AEAD key types\n\nDescription\n-----------\n\n[Envelope encryption](/tink/client-side-encryption) uses a third-party provider\n(such as GCP or AWS) to encrypt a data encryption key (DEK).\n\nIt is possible to modify certain parts of the encrypted DEK without detection\nwhen using `KmsEnvelopeAead` with `AwsKmsAead` or `GcpKmsAead` as the remote\nprovider. This is due to the inclusion of unauthenticated metadata (for instance\nversion numbers). Modifications to this unauthenticated data are not detected by\nthe provider.\n\nNote that this violates the adaptive chosen-ciphertext attack property\n(IND-CCA-2) for this interface, although the ciphertext can still decrypt to\nthe correct DEK. When using this interface don't presume that each DEK only\ncorresponds to a single *encrypted DEK*."]]
